KanarekLife / proxmox-idmap-helper

https://proxmox-idmap-helper.nieradko.com
MIT License
5 stars 3 forks source link

Host/Container IDs are reversed (I think) #14

Open fake-name opened 1 year ago

fake-name commented 1 year ago

I'm trying to map id 1001 in a container to 1000 on my host.

The web tool generates:

# Generated with Proxmox LXC idmap helper created by Stanisław Nieradko
lxc.idmap: u 0 100000 1000
lxc.idmap: g 0 100000 1000
lxc.idmap: u 1000 1001 1
lxc.idmap: g 1000 1001 1
lxc.idmap: u 1001 101001 64535
lxc.idmap: g 1001 101001 64535

However, this does not work. It's worth noting my host does not have a user with id 1001.

looking around, it seems like the ordering of the arguments to at least the second pair of idmap values are backwards. (lxc.idmap: u 1000 1001 1). https://www.reddit.com/r/Proxmox/comments/jz5ugx/lxc_user_mapping_help/ seems to indicate that the first value is the id for the container, and the second is is the id for the host. I also tried https://github.com/ddimick/proxmox-lxc-idmapper, and it seems to reflect this behaviour. Also, it's output works!

So it seems like if you are mapping one id to a different in the host, you need to swap the host/container ids to get a correct result.

root@proxmox:~# ./idmapper 1001=1000

# Add to /etc/pve/lxc/<container_id>.conf:
lxc.idmap: u 0 100000 1001
lxc.idmap: g 0 100000 1001
lxc.idmap: u 1001 1000 1
lxc.idmap: g 1001 1000 1
lxc.idmap: u 1002 101002 64534
lxc.idmap: g 1002 101002 64534

# Add to /etc/subuid:
root:1000:1

# Add to /etc/subgid:
root:1000:1

This is also the behaviour I get from this tool if I put the container ID in as the host ID, and vice versa, so it can generate the correct output, it's just the inputs are backwards.

Badn1nja commented 1 year ago

Second this.. It seems to be generating them backwards to the examples in projects i am setting up.. not superhelpful when trying to understand the weirdness of subgids!

jo-me commented 1 year ago

I created a PR for this. Feel free to use https://jo-me.github.io/proxmox-idmap-helper in the meantime.